aaronrene / overseer-kit public
governance-closeout-github-actions.yml yaml
113 lines 4.3 KB
Raw
sha256:106ef9e12cca7f3be3ffb2a6bd3abfa76f032dce453c9e5010d732a8d86f2e14 Reconcile reviewed credential compatibility 32254cd939885d9… Human patch 8 days ago
1 # HISTORICAL PRE-RESET TEMPLATE — not supported by bounded v1.
2 # Do not activate: commands below belong to the preserved legacy implementation.
3 # Supported Git/Muse fixture CI: .github/workflows/supported-v1.yml.
4 # The former activation guidance below is retained only as history.
5
6 # Example: post-merge governance closeout nudge (§PMHF.7). OPT-IN template only.
7 # Vendored by ok sync — copy to .github/workflows/governance-closeout.yml in consumer
8 # repos when wanted (Tier 2 confirm-once). Not required for the CLI floor:
9 # `ok status --exit-code` and `ok land-closeout` remain the always-on primary.
10 #
11 # Frozen bans (§PMHF.7):
12 # - No `git push` to main from this workflow.
13 # - No applying governance-sync patches directly onto main in CI (dry-run only here;
14 # a docs PR, if ever used, must commit to a feature branch and open PR → main).
15 # - No Cursor-only steps.
16 # - No secrets beyond the standard GITHUB_TOKEN for comment/PR.
17 #
18 # Preferred v1 is comment-only: when the dry-run plan shows D1/D2 drift or
19 # `ok land-closeout` is not ok, the workflow fails (visible check) and comments the
20 # plan summary + frozen land-b remediation on the merged PR when detectable.
21 #
22 # Degrade path: when CI is unavailable, run `ok land-closeout` locally — never treat
23 # CI unavailability as pass; agents still run land-b / ok governance-sync.
24
25 name: governance-closeout
26
27 on:
28 push:
29 branches: [main] # adjust to your vcs.git.main_branch when different
30 workflow_dispatch:
31
32 permissions:
33 contents: read # read-only checkout — structurally cannot push to main
34 pull-requests: read
35 issues: write # PR conversation comment (nudge) only
36
37 jobs:
38 closeout:
39 runs-on: ubuntu-latest
40 steps:
41 - uses: actions/checkout@v4
42
43 - name: Set up Python
44 uses: actions/setup-python@v5
45 with:
46 python-version: "3.11"
47
48 - name: Install Overseer Kit CLI dependencies
49 run: pip install PyYAML
50
51 - name: Governance-sync dry-run plan (read-only; never applies on main)
52 run: |
53 set -o pipefail
54 ./cli/ok governance-sync --dry-run | tee governance-closeout-plan.txt
55
56 - name: Land closeout probe (exit 2 keeps the check red until land-b)
57 env:
58 GH_TOKEN: ${{ github.token }}
59 run: |
60 set -o pipefail
61 status=0
62 ./cli/ok land-closeout --probe-merged-pr --json \
63 | tee land-closeout.json || status=$?
64 if grep -Eq "D1=drifted|D2=drifted" governance-closeout-plan.txt; then
65 status=2
66 fi
67 {
68 echo "## Governance closeout"
69 echo '```'
70 cat governance-closeout-plan.txt
71 cat land-closeout.json
72 echo '```'
73 } >> "$GITHUB_STEP_SUMMARY"
74 exit $status
75
76 - name: Comment land-b remediation on the merged PR (nudge only)
77 if: failure()
78 uses: actions/github-script@v7
79 with:
80 script: |
81 const fs = require('fs');
82 const plan = fs.existsSync('governance-closeout-plan.txt')
83 ? fs.readFileSync('governance-closeout-plan.txt', 'utf8').slice(0, 4000)
84 : '(no plan output)';
85 const body = [
86 '**Governance closeout incomplete after merge to main.**',
87 '',
88 'land_closeout-remediation: land-b required: ok governance-sync --dry-run',
89 'then apply; paste land-b; do not re-paste land-a',
90 '',
91 '<details><summary>governance-sync dry-run plan</summary>',
92 '',
93 '```',
94 plan,
95 '```',
96 '</details>',
97 ].join('\n');
98 const prs = await github.rest.repos.listPullRequestsAssociatedWithCommit({
99 owner: context.repo.owner,
100 repo: context.repo.repo,
101 commit_sha: context.sha,
102 });
103 const merged = prs.data.find((pr) => pr.merged_at);
104 if (merged) {
105 await github.rest.issues.createComment({
106 owner: context.repo.owner,
107 repo: context.repo.repo,
108 issue_number: merged.number,
109 body,
110 });
111 } else {
112 core.info('No associated merged PR found — remediation stays in the job summary.');
113 }
File History 2 commits
sha256:106ef9e12cca7f3be3ffb2a6bd3abfa76f032dce453c9e5010d732a8d86f2e14 Reconcile reviewed credential compatibility 32254cd939885d9… Human patch 8 days ago
sha256:c87cf2c2f03da507f66f93922cb339a2cbebb33ad6372a6039032fb09a20da12 Reconcile reviewed Overseer recovery d47291d5d9030de5ebef71… Human minor ⚠ 9 days ago